Govt Declares Key Data Systems as Critical Infrastructure
The ‘Information Systems & Data’ of critical infrastructures—namely NADRA, IMMPASS, and the Federal Board of Revenue (FBR)—have been declared as “Critical Information Infrastructures” (CIIs), while a summary for the designation of the Telecom Sector and Pakistan Telecommunication Authority (PTA) is currently under process for approval by the Federal Cabinet.
This has been revealed in official documents of the Ministry of Information Technology and Telecommunication (MoITT).
Under Rules 3 and 5 of the CERT Rules, the “Cyber Security for Digital Pakistan” PSDP project was conceived by MoITT and is being executed by the National Telecommunication & Information Security Board (Cabinet Division). This project has been designated and Gazette-notified as the National Computer Emergency Response Team (NCERT). Its soft launch began in July 2023, with the hiring of technical human resources and acquisition of capabilities expected to be completed by June 2025.
A ‘CERT Council’ has also been established as a consultative and coordinating forum to advise CERTs on effectively implementing their functions and services. The council is chaired by MoITT and includes members from MoD, MoI, MoFA, PTA, national, provincial, and sectoral CERTs, academia, industry, and civil society.
Under Rule 4(2), the CERT Council has recommended the notification of Provincial CERTs (Punjab, Sindh, KPK, Balochistan, AJK, GB) and Sectoral CERTs (Defence, Telecom, Community). A summary for their approval is currently being processed.
CERTs at national, provincial, and sectoral levels are expected to significantly strengthen Pakistan’s cybersecurity posture, resilience, and defence. As per PECA-2016 and CERT Rules-2023, the designation of CIIs mandates concerned organizations and licensees to implement stringent cybersecurity measures. It also empowers competent authorities to take punitive actions and legal proceedings—including investigations, prosecution, and conviction of cybercriminals under relevant laws.
